---
layout: docs
page_title: 'nomad acl binding-rule create command reference'
description: |
  The `nomad acl binding-rule create` command creates new access control list (ACL) binding rules. Set a description, associated authentication method, selector expression, or bind name. Configure role, policy, or management bind type.
---

# `nomad acl binding-rule create` command reference

The `acl binding-rule create` command is used to create new ACL Binding Rules.

## Usage

```plaintext
nomad acl binding-rule create [options]
```

The `acl binding-rule create` command requires the correct setting of the create options
via flags detailed below.

## Options

- `-description`: A free form text description of the binding-rule that must not exceed
  256 characters.

- `-auth-method`: Specifies the name of the ACL authentication method that this
  binding rule is associated with.

- `-selector`: Selector is an expression that matches against verified identity
  attributes returned from the auth method during login.

  ~> **Caveat:** Selectors that operate on `ClaimMappings` (as opposed to
  `ListClaimMappings`), the key that we match against has to be prefixed with
  `value.`

- `-bind-type`: Specifies adjusts how this binding rule is applied at login time
  to internal Nomad objects. Valid options are `role`, `policy`, and `management`.

- `-bind-name`: Specifies is the target of the binding used on selector match.
  This can be lightly templated using HIL `${foo}` syntax. If the bind type is
  set to `management`, this should not be set.

- `-json`: Output the ACL binding-rule in a JSON format.

- `-t`: Format and display the ACL binding-rule using a Go template.

## Examples

Create a new ACL Binding Rule:

```shell-session
$ nomad acl binding-rule create \
    -description "example binding rule" \
    -auth-method "auth0" \
    -bind-type "role" \
    -bind-name "eng-ro" \
    -selector "engineering in list.roles"
ID           = 698fdad6-dcb3-79dd-dc72-b43374057dea
Description  = example binding rule
Auth Method  = auth0
Selector     = "engineering in list.roles"
Bind Type    = role
Bind Name    = eng-ro
Create Time  = 2022-12-20 11:15:22.582568 +0000 UTC
Modify Time  = 2022-12-20 11:15:22.582568 +0000 UTC
Create Index = 14
Modify Index = 14
```

Create a new ACL Binding Rule where the selector needs to be escaped on UNIX
machines:

```shell-session
$ nomad acl binding-rule create \
    -description "example binding rule" \
    -auth-method "auth0" \
    -bind-type "role" \
    -bind-name "eng-ro" \
    -selector "\"product-developer\" in list.roles"
ID           = 698fdad6-dcb3-79dd-dc72-b43374057dea
Description  = example binding rule
Auth Method  = auth0
Selector     = "\"project-developer\" in list.roles"
Bind Type    = role
Bind Name    = eng-ro
Create Time  = 2022-12-20 11:15:22.582568 +0000 UTC
Modify Time  = 2022-12-20 11:15:22.582568 +0000 UTC
Create Index = 14
Modify Index = 14
```

Create a new ACL Binding Rule where the selector needs to be escaped on Windows
machines via PowerShell:

```shell-session
$ nomad.exe acl binding-rule create \
    -description "example binding rule" \
    -auth-method "auth0" \
    -bind-type "role" \
    -bind-name "eng-ro" \
    -selector="`"project-developer`"
ID           = 698fdad6-dcb3-79dd-dc72-b43374057dea
Description  = example binding rule
Auth Method  = auth0
Selector     = "\"project-developer\" in list.roles"
Bind Type    = role
Bind Name    = eng-ro
Create Time  = 2022-12-20 11:15:22.582568 +0000 UTC
Modify Time  = 2022-12-20 11:15:22.582568 +0000 UTC
Create Index = 14
Modify Index = 14
```

Create a new ACL Binding Rule where the selector uses a mathing against a
single `ClaimMapping` which uses `owner` as its value:

```shell-session
$ nomad acl binding-rule create \
    -description "example binding rule" \
    -auth-method "github" \
    -bind-type "role" \
    -bind-name "eng-ro" \
    -selector="value.owner == user"
ID           = 698fdad6-dcb3-79dd-dc72-b43374057dea
Description  = example binding rule
Auth Method  = github
Selector     = "value.owner == user"
Bind Type    = role
Bind Name    = eng-ro
Create Time  = 2022-12-20 11:15:22.582568 +0000 UTC
Modify Time  = 2022-12-20 11:15:22.582568 +0000 UTC
Create Index = 14
Modify Index = 14
```

## General options

@include 'general_options_no_namespace.mdx'
